For group membership I am using LDAP for performing the consumer matching. I can pretty clearly see how to do simple matches with ORs or ANDs, but I would like to match in a more complicated fashion. For example, while this is obvious

The only mechanism I've found to do this is by creating a new LDAP group that contains all the members of Dep1 and Dep2, however this also means managing additional group memberships and would exist outside of PGP itself. Is this type of functionality even available in Universal? Are there ways to reasonably simulate the behavior internal to the system?